Posted at 2021-12-30 by @fanoush

did you get some data from their servers? I tried it like half year ago and the trial user/password worked to get agps data, but last time I tried (week ago?) it did not work for me

Posted at 2021-12-30 by HughB

did you get some data from their servers?

Just tried it and I got.
I suspect we will have to raise a support case on the site to a trial username and password.
The code is from 2015, so maybe the trial account is no longer the same.

$ ./agps_demo 
AGPS demo.
Create a socket.
Get agps server by name.
Copy agps server information to socket address struct
Connect to agps server.
Build agps message.
Message: user=freetrial;pwd=123456;lat=30.1;lon=120.2;
Send message to agps server.
Wait for server transferring agps data.
Received 25 bytes from agps server.
All agps data are received.
Total bytes: 25
Demostrate agps_buffer, agps_buffer_length = 25.

ERROR: INVALID USER/PWD.


Now, you can send these data to gnss module through tty.
Using code like:
write(tty_fd, agps_buffer, agps_buffer_length);
$ 

Posted at 2021-12-31 by @fanoush

yes, same result, this worked for me some (long) time ago. I am not so optimistic about support case but yes we can try to contact them that the example does not work. I guess the right solution in the long run may be to get own user/password for bangle or figure out the one that is used by original Q3 firmware/android app.

Posted at 2022-01-01 by HilmarSt

Please provide the links to the Q3 firmware / App.
Then I can have a "look" into the code...

Posted at 2022-01-01 by fparri

I think this is the Android app: https://play.google.com/store/apps/details?id=com.sma.smartv3

Posted at 2022-01-01 by @fanoush

I use "Join Fit Watch" with Q3, that one was linked in manual that came with it.

Posted at 2022-01-01 by fparri

Ah perfect! Thanks for pointing out, Fanoush :)

Posted at 2022-01-02 by HilmarSt

Thanks user137757 and Fanoush.
com.sma.smartv3 is for "Q3 / R4 / R5 series watches"
com.jion.fit is for "F3 / R3 / Q3 / AFWG0720 series watches"
So there's a big range of watches that seem to share the same AGPS mechanism.

Posted at 2022-01-02 by HughB

That would not surprise me, especially if the watches all use the same chip, plus would expect quite a bit of commonality across manufacturers and suppliers of AGPS data.

Posted at 2022-01-05 by @gfwilliams

Thanks - this looks really promising. If you can find a URL @HilmarSt I can set my server up to grab data off it once a day and host locally, which is what I do for UBlox AGPS on Bangle.js 1.

I'm not sure, but for UBlox you literally just stream the file you downloaded straight to the GPS chip - it contains all the commands already. It is possible that this one is similar too...

Posted at 2022-01-05 by HughB

I read the code and its seems to construct the necessary UBLOX commands in the javacript that is embedded in the HTML interface.

We would have to work out the necessary CASIC commands to do this. I am working on trying to get a checksum function working for CASIC. Should get back to that soon, but I am back at work now so its the odd hours in the evening now.

Posted at 2022-01-05 by @fanoush

if you can find a URL

it is not like ublox which makes it public at http://alp.u-blox.com/
you need to apply for user/password, see attached PDF (got it from their site and translated via google)
"AGNSS currently only provides AGNSS services to authorized customers
• AGNSS only provides assistance to Zhongkewei's GNSS receivers.
"

Attachments:

• 3 Hangzhou Zhongke Micro AGNSS Account Application Process by LHJ 2015-12-09.pdf
• Zhongke Micro AGNSS Solution.pdf

Posted at 2022-01-08 by HilmarSt

Just a crazy idea:
If you follow the download link from HughB in #1 ( https://www.icofchina.com/d/file/xiazai/2020-09-22/26ac3f347aca9fc6c3a23db296b0dec0.zip?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-GB ), you will get a .zip file which contains GnssToolKit3.exe . If you start it, it waits for a connection to a COM port.
[crazy on]
Would it be possible to route the internal COM ports of the watch via Bluetooth serial to GnssToolKit3.exe ?
[/crazy off]
If this is working, it should be possible to look at the communication with a com port sniffer and eventually get hints for the CASIC communication or (I'm dreaming) AGPS.
btw: You can set GnssToolKit3.exe to English with the rightmost menu entry, 3rd item and restart of the program.

While searching the internet for "gnss-aide.com" it seems that also ublox devices use this service. Which AGPS provider does the Bangle.js 1 use?

Posted at 2022-01-08 by HughB

There's a working bit of code that does a AGPS load written in C for the AT6558 that demonstrates how to send the CASIC commands for AGPS. What we need are the checksum calculation writing and the AGPS Bangle1 app cloning to use the CASIC commands. If a simple bit of javascript can be written that will load 1 set of AGPS data onto the B2 then I am sure someone would be able to do the web wrap. There is a lot of stuff I dont understand in the web wrap for the Bangle1 AGPS App, but I can see how it works from a UBLOX perspective. I was working on the checksum function but got sidetracked with analogue clocks etc :)

Posted at 2022-01-08 by @fanoush

ther is no standard for com port over BLE but it could work with something like https://github.com/Jakeler/ble-serial if bangle would make gps serial available over bluetooth as one of those ble serial adapters (like HM-10) which is quite easy.

However I guess the data received from that password protected agps service could be simply written to the gps as is. But still that GnssToolKit3 tool could be interesting to use.

Posted at 2022-01-09 by Mark_M

It would be very nice to have such gateway. Because that would allow to update AT6558 firmware. Currently it is quite outdated. Some CASIC commands work, some do not. I even cannot figure out how to see SW version.

//MON-VER
Serial2.write([0xBA,0xCE, 0x00,0x00, 0x0A,0x04, 0x00,0x00,0x0A,0x04]);
//MON-HW
Serial2.write([0xBA,0xCE, 0x00,0x00, 0x0A,0x09, 0x00,0x00,0x0A,0x09]);

It returns ACK-NACK

Posted at 2022-01-09 by Mark_M

It would be very nice to have such gateway. Because that would allow to update AT6558 firmware. Currently it is quite outdated. Some CASIC commands work, some do not. I even cannot figure out how to see SW version.

//MON-VER
Serial2.write([0xBA,0xCE, 0x00,0x00, 0x0A,0x04, 0x00,0x00,0x0A,0x04]);
//MON-HW
Serial2.write([0xBA,0xCE, 0x00,0x00, 0x0A,0x09, 0x00,0x00,0x0A,0x09]);

It returns ACK-NACK

When I try to query via CFG-MSG, it again returns ACK-NACK

Serial2.write([186, 206, 4, 0, 6, 1, 10, 4, 255, 255, 14, 4, 5, 1])

Some messages return ACK-ACK, but never return result payload.
I suspect that there is very early version of CASIC.

Posted at 2022-01-10 by HilmarSt

If you can find a URL...

I've tried to find one in the .apk and in .dex -> .jar -> .java but with no success.

As the communication with www.gnss-aide.com seems to be not encrypted, there should be a good chance to find the URL in the communication of the Android App with help of the Wireshark protocol analyzer.
For a working Android App, some original hardware (e.g. an original Q3) is needed - Gordon, if you can send me one I will try again to find a URL ;-)

Posted at 2022-01-10 by @fanoush

As the communication with http://www.gnss-aide.com seems to be not encrypted, there should be a good chance to find the URL in the communication of the Android App with help of the Wireshark protocol analyzer.

you can also just setup a http proxy for network connection in android an check proxy logs

For a working Android App, some original hardware (e.g. an original Q3) is needed - Gordon, if you can send me one I will try again to find a URL ;-)

If you can use SWD it is possible to flash original Q3 firmware to bangle 2 and later revert back. With a bit of luck and experience it is possible also without SWD, but you already know that if it is your case ;-) I can PM you direct link to Q3 firmware DFU zip on their servers if you know what to do with it. It needs softdevice S140 6.1.1 which is not the one used currently for Espruino.

Posted at 2022-01-10 by @gfwilliams

Well that's irritating - I just tried here with an unflashed Q3 and despite setting up a proxy with a trusted certificate, the app doesn't trust it.

However when I try to update the AGPS it requests some API at SMA by the look of it, so I doubt it goes direct. Although we may be able to get the GPS data second-hand from SMA's servers.

@HilmarSt were you looking in the code for a gnss-aide.com address? What about if you try and look for some GPS-related API access?

Posted at 2022-01-10 by @fanoush

Well that's irritating - I just tried here with an unflashed Q3 and despite setting up a proxy with a trusted certificate, the app doesn't trust it.

I think you need rooted phone and put certificate to system partition for it to work for android 7 and up. however proxy only for http could work? https://stackoverflow.com/a/22040887 or see https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/

but I guess using device with android <7 may be easier?

Posted at 2022-01-10 by HilmarSt

fanoush, thank you very much for the offer.
I can't do SWD and it feels I'm currently out of "a bit of luck and experience" ;-)

Posted at 2022-01-10 by HilmarSt

were you looking in the code for a gnss-aide.com address?

I've used a .dex to .java decompiler and did a full text search in the sources.
But now I think that SMA isn't so unexperienced to allow this:
If I were SMA and wanted to protect my credentials I would authenticate the watch via API, wait for the SMA server to download from gnss-aide.com and provide the AGPS data via API - I think, thats what you observed.
I'm not experienced enough to find the AGPS data in the protocol, so I give up.

Maybe someone is able to solder 2 wires to the serial port of the GPS hardware in the Q3 watch and capture the AGPS data from there...

Posted at 2022-01-10 by @gfwilliams

Well that was painful, but: https://api.smawatch.cn/epo/ble_epo_offline.bin

Posted at 2022-01-10 by HilmarSt

Nice:

AGNSS data from CASIC.
DataLength: 2434.
Limitation: 7/1000.
...

I'm number 7 of 1000 allowed downloaders.

How did you do that?

Posted at 2022-01-11 by Mark_M

Now I see why the CASIC protocol is so poorly documented. Many functions do not work as documented. No firmware updates, etc...
Probably all is classified...
https://en.wikipedia.org/wiki/China_Aerospace_Science_and_Industry_Corporation

Posted at 2022-01-11 by Mark_M

I'm number 7 of 1000 allowed downloaders.

me too :)

I suspect the bin is something specific to CASIC. I do not know what it is for.
The actual EPO file is in subdir with name of YYYYMM, https://api.smawatch.cn/epo/202201/

You can also download big EPO from
http://epodownload.mediatek.com/EPO.DAT
people is saying...

This information can be downloaded from MediaTek as well, in a much larger file, comprising 30 days of satellite data

http://epodownload.mediatek.com/EPO.DAT
MediaTek 276480 bytes vs Garmin's 64512
but only 28 days with valid data seem to be present at all times. Day 29 and/or 30 have all their satellite number fields zeroed out (00).

https://www.reddit.com/r/Garmin/comments/hyg0l5/manual_gps_epobin_update_with_garmin_offline_for/

so it probably needs to be shrunk to the first 258048 bytes.

Posted at 2022-01-11 by pelrun

Well that ble_epo_offline.bin file is just a bunch of CASIC MSG-GPSEPH/MSG-GPSION/MSG-GPSUTC messages with a text header. So there's nothing too tricky about it. If the chip accepts it we could even build it ourselves using data from another service (e.g. supl.google.com) or pulled from another gps unit.

Posted at 2022-01-11 by Mark_M

According to CASIC docs MSG-GPSEPH/MSG-GPSION/MSG-GPSUTC messages are "type cycle" (read-only). Is it possible to set that data using these messages? May be these are to dump a sort of backup?
It appears that EPO data is not standardized. Each vendor uses their format.
I am reading https://www.researchgate.net/publication/351855783_Partial_Decoding_of_the_GPS_Extended_Prediction_Orbit_File
Interesting article.

Posted at 2022-01-11 by Mark_M

actually if you download AGPS.zip from https://www.icofchina.com/xiazai/# and then translate Chinese docs, there are descriptions how to load Long Term Ephemeris data. I assume it is the larger DAT file in YYYYMM subdirectory.

Posted at 2022-01-11 by pelrun

I can completely parse the ble_epo_offline file, and it doesn't make sense for these messages to be used if they're really read-only. It's possible they've been nasty and added extra checksum values in the reserved fields that have to be correct in order to accept the message.

I'm not yet convinced the .DAT files are useful; they're either obfuscated or they're a completely unknown format. Edit: just read that paper Mark_M cited - that's definitely the same format, and since it's for a Mediatek GPS chipset it looks like those files are intended for another SMA product that uses it - not useful for us.

Posted at 2022-01-11 by @gfwilliams

Limitation: 7/1000

My guess is that SMA download off of CASIC's servers, and just copy it to their own server every few hours. That way everyone gets the same file, they don't go past their download limits or distribute their username/password.

Well that ble_epo_offline.bin file is just a bunch of CASIC MSG-GPSEPH/MSG-GPSION/MSG-GPSUTC messages with a text header.

Ok, so are we saying we just strip off the header and stream it direct to the GPS? Regardless of what they say in the docs, it'd be easy enough to test if it decreased the time to get a fix.

edit: Just to add that I'm not sure what 'read only' means in this context, but you'd expect the almanac data to only be written to RAM (not flash)? After all, it'll be kept as long as the battery doesn't go flat, which is what happens to the almanac data that is read direct from the GPS

Posted at 2022-01-11 by pelrun

It's volatile data, definitely. Standalone GPS units invariably have a ram backup battery to keep the most recent almanac/ephemeris/location/time data to allow a warm boot, but I'd expect the watch to be designed to keep the gps warm off the main battery even when disabled (it's microamps or less) or else the software needs to cache the AGPS data and feed it back in when necessary.

The other part of improving the TTFF is having an approximate location/time to start from, which obviously isn't part of the ephemeris data. The AGPS.zip file has code that builds an AID-INI message that has that in it, so I think the full solution is going to need both parts.

Posted at 2022-01-11 by Mark_M

There are NMEA (CAS00) and CASIC (CFG-CFG) commands that allow to clear, save and load configuration information to/from the chip internal flash.
When I turned on/off the chip, it restarted warmly. I assume it uses the main battery to keep itself warm. But you can restart it fresh even with factory settings.
I believe the second (bigger) long term DAT file is loaded between AID-INI 06 AID-INI 09 commands. The commands are not documented in the docs v3.6 and v4.2. According to AGPS C code the file does not need to be decrypted and should be loaded as is. But I did not try.
I agree that the smaller file can be pushed as is as well even with its text header that should be ignored by the chip. But this feature is not documented as well.
When I send CFG-MSG with query for MSG-GPSUTC it returns ACK-ACK (success). But it does not return the actual MSG-GPSUTC payload.

Serial2.write(new Uint8Array([186, 206, 4, 0, 6, 1, 8, 5, 255, 255, 12, 5, 5, 1]).buffer)
{ "hdr": 47822, "len": 4,
  "payload": new Uint8Array([6, 1, 0, 0]).buffer,
  "payloadBytes": new Uint8Array([6, 1, 0, 0]),
  "class": 5, "msgId": 1,
  "checkSum": new Uint8Array([10, 1, 5, 1]),
  "name": "ACK-ACK"
 }

When I pushed last 3 messages from the file I've got NACK for 0x08,0x07 and ACKs for 0x08,0x05 and 0x08,0x06

Serial2.write(new Uint8Array([0xBA,0xCE,0x48,0x00,0x08,0x07,0xBD,0x38,0x5C,0x4D,0xF8,0x63,0x0D,0xA1,0xBC,0x23,0x5B,0x05,0x3D,0x0F,0xDD,0x0E,0xE6,0xA4,0xAE,0xF2,0x9B,0x5B,0xE8,0x26,0x79,0x89,0x29,0x4C,0xD9,0xA6,0xFF,0xFF,0x1D,0x32,0x72,0xFF,0x2B,0x03,0xD5,0x12,0x36,0x19,0x1B,0x03,0x47,0x00,0x25,0x00,0xF2,0x2B,0x90,0x00,0xF2,0x2B,0x00,0x00,0x2E,0xC7,0xFA,0xFF,0xF0,0xFF,0x00,0xE4,0x13,0x00,0x00,0x00,0x1F,0x03,0x43,0x38,0xC2,0x71,0xC0,0xA1]).buffer);

Serial2.write([0xBA,0xCE,0x14,0x00,0x08,0x05,0x92,0x19,0x66,0x90,0xFC,0xFF,0xFF,0xFF,0xFB,0xFF,0xFF,0xFF,0x12,0x12,0x63,0x90,0x89,0x07,0x03,0x00,0x38,0x33,0xD4,0x25]);

Serial2.write([0xBA,0xCE,0x10,0x00,0x08,0x06,0x47,0xF5,0xFD,0x11,0x0C,0xFF,0xFF,0x02,0x38,0xF6,0xFD,0x0E,0x03,0x00,0x00,0x00,0x9E,0xEA,0x03,0x2A]);

Posted at 2022-01-11 by HilmarSt

Does a particular message always gets NACK - even when sent in a different order or with pauses between them?
I'm thinking of "NACK = currently busy - please try again later".

Posted at 2022-01-11 by Mark_M

I am more afraid that size of the message can be a factor. Can Espruino split the array making it not a byte buffer, but rather an associated array due to free RAM fragmentation?
I tried with new Uint8Array([...]).buffer , but got no success.

Posted at 2022-01-11 by pelrun

The paper and links you've found make it very clear that the .DAT files are specifically for Mediatek GPSes. Since we don't use one of those there's no point chasing that red herring.

I just tried the three messages you listed myself and got ACK-ACK for all of them.

Posted at 2022-01-11 by pelrun

Incidentally, I had to turn off all the NMEA messages with CAS03 before I got reliable responses from the CASIC commands.

Posted at 2022-01-11 by Mark_M

The paper and links you've found make it very clear that the .DAT files are specifically for Mediatek GPSes.

is this file for Mediatek? https://api.smawatch.cn/epo/202201/m2_epo_offline_2022-01-11_847f4858827d0765e0402b8d7158c0aa.DAT

I just tried the three messages you listed myself and got ACK-ACK for all of them.

That is good! May be I just need to restart the watch to defragment RAM.

Posted at 2022-01-11 by HughB

I had to turn off all the NMEA messages with CAS03 before I got reliable responses f

Can you share the command string for this. I could not get them to shut up at all.

Posted at 2022-01-11 by Mark_M

Serial1.println("$PCAS03,0,0,0,0,0,0,0,0,0,,0,,,0*32")

Posted at 2022-01-12 by @gfwilliams

That is good! May be I just need to restart the watch to defragment RAM.

On Bangle.js 2 I seriously doubt available RAM is a factor you have 256k - and every time you load a new app, RAM is cleared, so defragmentation will not be an issue.

PCAS03

Interestingly looking at the watch firmware, it pretty much only ever seems to send:

"$PCAS03,1,0,0,0,0,0,0,0,0,0,0,0*..."

Which is setting it to GGA only? I wonder if that helps with power usage at all...

Posted at 2022-01-12 by @gfwilliams

I posted this up in some previous conversation, but had trouble finding it now, so: geary/AnyTone-D868UV#61

Some interesting info about improving time to GPS lock there

Posted at 2022-01-12 by Mark_M

Basically the advise there is - turn off Beydou.
This is quite simple, the command can be send to Serial any time.
Another interesting item in the article to check GPS antenna soldering. http://members.optuszoo.com.au/jason.reilly1/868mods.htm?fbclid=IwAR3We8hIt20lFBOhBdOoGneDnTRfB2PTQAMff1Tsupw06QlFLPlOnOnBRLE#FasterGPS
Yes, it is different device - radio. But who knows, NMEA shows antenna is off, may be it is. Gordon, if you have disassembled watch, could please you take a look if soldering there is done properly?

Posted at 2022-01-12 by @gfwilliams

As far as I can tell from the board I have here it's fine - the antenna arrangement is very different but the two connections look fine. Honestly, I think if the antenna wasn't connected you wouldn't see any GPS lock.

I've just updated the AGPS app on https://espruino.github.io/BangleApps/ and it should now work with GPS. Hopefully it also turns off Beidou.

Not sure if I missed this discussion elsewhere (there seem to be a bunch of threads open now) but in https://www.icofchina.com/d/file/xiazai/2017-05-02/ea0cdd3d81eeebcc657b5dbca80925ee.pdf there are some interesting NAV-PV/NAV-TIMEUTC commands that I guess may really help.

The commend in the AGPS.zip file that @hughb found could appear to be AID-INI that's mentioned at https://www.icofchina.com/d/file/xiazai/2020-09-22/20f1b42b3a11ac52089caf3603b43fb5.pdf?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-GB but given it's not mentioned in the other doc we found I wonder if out GPS/firmware version accepts it

... also that GitHub link I posted shows some other (undocumented) form of ASCII lat/lon string that the device they have is sending. I guess one option is I reflash a dismantled Q3 that I have, solder onto the GPS RX/TX wires, and then try and run AGPS and see what commands are actually sent to the chip

Posted at 2022-01-12 by Mark_M

If you are talking about the string after PCAS04
$PMTK�PMTK�$GPTXT�$GNRMC�$GPRMC�$GPGGA�$GPGSV�,0�,1,25,180000,60000�,1,3000,12000,18000,72000�,0,1,0,1,0,5,0,0,0,0,0,0,0,0,0,0,0,0��$PCAS02,1000�$PCAS03,1,0,0,0,1,0,0,0�$PCAS03,0,0,0,1,0,0,0,0�$PCAS04,3�**,091926.000,3113.3166,N,12121.2682,E,0.51,09,0.9,36.9,M,7.9,M,,000056�,961639.00,A,2458.21111,N,11838.31444,E,0.18,,091217,,,A,V*,,***
I do not think it is a command as is. It does not have any prefix. It may be a constant for default value for something. To find it out we need to sniff traffic.
Also, these $PMTK tell me that it is for MTK chip.

Posted at 2022-01-12 by BartS23

I have tried the AGPS update on my Bangle 2.

Unfortunately, I no longer get any GPS messages.
Neither via on('GPS-raw'), nor via on('GPS').

I tried a reboot, reboot without code and factory reset.
Nothing helped.

>Bangle.on("GPS", print)
=undefined
>Bangle.on("GPS-raw", print)
=undefined
>Bangle.setGPSPower(1)
=true
ÿ$GPTXT,01,01,02,MA=CASIC*27 false
$GPTXT,01,01,02,IC=AT6558-5N-32-1C510800*48 false
$GPTXT,01,01,02,SW=URANUS5,V5.1.0.0*1F false
$GPTXT,01,01,02,TB=2018-04-18,10:28:16*40 false
$GPTXT,01,01,02,MO=GB*77 false
>new Date
=Date: Wed Jan 12 2022 15:35:25 GMT+0100
>new Date
=Date: Wed Jan 12 2022 15:37:37 GMT+0100

Posted at 2022-01-12 by Mark_M

you receiving GPTXT. So your GPS is fine. Try to enable messages via $PCAS03, i.e.

    Serial1.println("$PCAS03,1,0,0,0,0,0,0,0,0,,0,,,0*33")

Posted at 2022-01-12 by @gfwilliams

Thats an odd one, because I've run this on several devices here and it's been fine. Were you experimenting with it before and could you have run PCAS03 yourself?

Posted at 2022-01-12 by BartS23

Thanks for your Help!

$PCAS03 solved my problem.

I did a little experimenting yesterday. But afterwards I was sure that it still worked.
Possibly I was the problem.
Sorry for the inconvenience.

Posted at 2022-01-13 by Mark_M

@gfwilliams
is it possible to request from SMA:

• documentation on CASIC protocol that is compatible with the AT6558 firmware that is installed into the watch
• firmware update for AT6558 and instructions how to apply ?

Posted at 2022-01-13 by @gfwilliams

is it possible to request from SMA:

I don't think so - I honestly think they don't know much more than us. Ideally we'd contact Hangzhou ZhongKe (the chip manufacturers)

Posted at 2022-01-13 by pelrun

Also I'm not sure what you're asking for out of this hypothetical firmware and documentation that we don't already have. So far what I've tried out of the existing documentation has worked, and anything that doesn't is unlikely to be rectified.

Posted at 2022-01-13 by Mark_M

I have two CASIC documents v3.6 and v4.2. Many CASIC commands do not work.
For example simple command - set message MON-VER 0x0A,0x04 to rate 0xFFFF to get software version

Serial2.write(new Uint8Array([186, 206, 4, 0, 6, 1, 10, 4, 255, 255, 14, 4, 5, 1]).buffer);

always returns NACK
If I call it as "poll"

new Uint8Array([186, 206, 0, 0, 10, 4, 0, 0, 10, 4]).buffer

it also returns NACK

If such a simple command does not work, it looks very suspicious to me.
Why I suggested to ask docs and new firmware from SMA, because you have purchased their product. When SMA purchased AT6558 chips from Hangzhou ZhongKe they probably got all current docs, binaries and support from them. They, as a big customer, also can request firmware updates.
Also their support page looks more customer friendly. https://smawatch.com/Support
I've looked at https://www.icofchina.com/contact/ support is only by phone and all is in Chinese.

Posted at 2022-01-13 by pelrun

Is there a specific feature you're trying to access? At the moment it just looks like you're fishing.

Also, as someone who has worked in the commercial embedded world for many years, "SMA ... probably got all current docs, binaries and support from them. They, as a big customer, also can request firmware updates." is just fundamentally incorrect in every respect. Half the time the documentation is provided under NDA, the other half of the time the documentation simply doesn't exist at all. And finally, even if SMA had some secret firmware update they weren't bothering to pass on to customers, why would they turn around and give it to us? They might be a big customer, but we aren't.

Posted at 2022-01-14 by Mark_M

Sure I am "fishing". I've bought this watch for fun, not for business. It is not a question of life and death for me if some functionality is not documented, and some completely does not work despite it is documented.
However, as many others I'd like to get updates and correct docs, examples, etc.
What is wrong with me? Am I desiring too much?
Yes I am not in professional embedded development. But I have some amateur experience with U-Blox. With U-Blox everything is well documented, you can download lots of docs, examples, firmware updates etc.
It is not under any NDA. Same with other vendors, like Nordic, Microchip... you name it.
ZhongKe publishes docs anyway. But it is just current ones. Older ones sit there and some available if a link can be found. So it is not secrets.
As well as a firmware is not a secret.

What I would try to use is RXM-SENSOR (0x03 0x07) - there is another accelerometer, gyroscope and thermometer.
May be RXM-MEASX for RINEX postprocessing.
May be I'd explore some ways that would allow to decrease power consumption, like CAS12 or like turning of reception of some sats if they are not useful.

Posted at 2022-01-14 by pelrun

It's not wrong to try and see what else you can get out of your device, but it's also important to temper your expectations. The documentation we have covers an entire class of devices with wildly different feature sets, and pricing to match. You get what you pay for, and SMA isn't going to spend extra on a chip with features they aren't intending to use or advertise. Heck, they probably designed the watch around the absolute cheapest option they had access to.

So, some of the commands you're aware of are for features that simply aren't present in the AT6558 - RINEX is one of those things that a manufacturer is likely to charge a lot more for, as that's sought after for more expensive devices in narrow markets with much higher margins on them than the consumer GPS market, like professional survey equipment. That said, the datasheet does claim the AT6558 is suitable for DGPS use, so shrug

And some commands are intended to give options to the hardware designer. There is no secret second IMU in the AT6558. Not even the more expensive chips have one. What they do have are spare pins on their IC packages that they can cheaply repurpose as a GPIO or serial bus expander. If you look at the datasheet you'll see several reconfigurable GPIO pins, including some that can be assigned as an I2c or SPI master. You can connect a separate device to these pins and then communicate with it via the GPS, which is useful if you've run out of pins on your primary microcontroller. This is explicitly called out in the datasheet in section 5.7 SPI - "SPI master device interface is used for connecting the SPI interface devices, such as MEMS sensors, FLASH, etc..". RXM-SENSOR is a convenience function for controlling an external IMU on this second bus - but since we already have an IMU directly connected to the nRF52 in the watch, this is unnecessary and therefore won't be connected to anything useful.

Posted at 2022-01-14 by @gfwilliams

Sure I am "fishing", I've bought this watch for fun... Am I desiring too much?

I provide you with what I know and the products of my work, for free. I'm not only doing that, but I work every day answering questions and improving Espruino for nothing more than the small profit I made on your initial purchase of the Bangle.

I said the Bangle.js had GPS, I've made it so you can totally access it from code, told you the exact model number and even linked to a datasheet most of which works. That's far more than any other watch manufacturer I'm aware of.

If there's not 100% accurate documentation then by all means go and find it yourself, contribute the result and I will happily add it to the docs so other users can find it.

Posted at 2022-01-14 by Mark_M

Hi Gordon, I appreciate what you are doing very much.
I am also sharing my findings here (and I also have free projects, i.e. FreeShip https://github.com/markmal/freeship-plus-in-lazarus).
Yes sometimes it is frustrating that something does not work. I usually do all efforts to find a solution by myself. I do not expect you should document the GPS, the ZhongKe should.
I've found and translated the CASIC docs from Chinese. I can share it here as well with notes about what does work and what does not.
What I asked for was not a demand to you rather a humble plea to try to get proper docs/updates from/through SMA. I believe you are quite a big customer for them based we purchased 2000+ watches. And it is growing.
But if it is impossible or hard to do I can understand it, no problem.
I just doubt we can get any response from ZhongKe if we contact them directly. But if SMA contacts them ZhongKe may provide them with firmware updates.
Anyway thank you again.

Posted at 2022-01-14 by Mark_M

"SPI master device interface is used for connecting the SPI interface devices, such as MEMS sensors, FLASH, etc..". RXM-SENSOR is a convenience function for controlling an external IMU on this second bus - but since we already have an IMU directly connected to the nRF52 in the watch, this is unnecessary and therefore won't be connected to anything useful.

yes, this makes sense.
Datasheet from ZhongKe AT-6558-R v1.7 does not mention thermometer or gyro. They published just one datasheet. Our chip is AT6558-5N-32-1C510800. They have "hidden" link to older DS https://www.icofchina.com/d/file/xiazai/2016-12-05/b1be6f481cdf9d773b963ab30a2d11d8.pdf
According to it our chip should not receive GLONASS. But it does. At least I saw 1 sat :)
They also declare - Support A-GNSS, Support D-GNSS differential positioning. But I do no trust :)

Posted at 2022-01-15 by @fanoush

humble plea to try to get proper docs/updates from/through SMA. ..... But if it is impossible or hard to do I can understand it, no problem.

It is more that

• It doesn't look like effort spent with this would help us with implementing agps any faster
• Current GPS firmware looks capable enough to handle AGPS
• Time spent doing as you say is time not spent on improving Bangle 2 firmware

Posted at 2022-01-15 by HilmarSt

I've found and translated the CASIC docs from Chinese. I can share it here as well with notes about what does work and what does not.

That would be very nice.

Posted at 2022-01-15 by Mark_M

I've already implemented loading of the "small" file ble_epo_offline.bin

Posted at 2022-01-15 by Mark_M

the zip file is here.

Attachments:

• CASIC-v4.2.zip

Posted at 2022-01-15 by Mark_M

interesting... Loading from file ble_epo_offline.bin some messages give NACK. For example, first always gives NACK. Second gives ACK.

B=new Uint8Array( [0xba,0xce,0x48,0x0,0x8,0x7,0x1e,0xda,0xe3,0xe5,0xae,0xd,0xe,0xa1,0x65,0x2,0xc6,0x2,0x8b,0xbd,0x47,0x9f,0xa9,0x9d,0x4f,0x9c,0x57,0xa7,0x6,0x27,0x40,0x71,0x14,0x20,0x3c,0xaa,0xff,0xff,0x6c,0x32,0x40,0x5,0xfe,0x0,0xd7,0xe,0x3b,0x1e,0x11,0x1,0x0,0x0,0xe2,0xff,0x52,0x80,0x90,0x0,0x52,0x80,0x0,0x0,0xcc,0x56,0xfe,0xff,0xca,0xff,0x0,0x1,0x5,0x0,0x0,0x0,0x20,0x3,0xc3,0xa8,0x84,0xb4,0xcf,0xd2]);
Serial2.write(B.buffer);

B=new Uint8Array(
[0xba,0xce,0x48,0x0,0x8,0x7,0xb2,0x32,0x6b,0x6b,0x5c,0xaf,0xc,0xa1,0x7c,0x7d,0xc6,0x2,0x3b,0xd8,0xd9,0x8f,0x26,0x34,0x6c,0xb,0xce,0x24,0x20,0x26,0xe3,0x6f,0xdf,0x4b,0xfc,0xa4,0xff,0xff,0x9f,0x39,0xec,0xfb,0x61,0xff,0xc2,0xd,0xec,0x1d,0x34,0xff,0x27,0x0,0x2b,0x0,0x52,0x80,0x90,0x0,0x52,0x80,0x0,0x0,0xc6,0x64,0xef,0xff,0xe9,0xff,0x0,0x8,0x48,0x0,0x0,0x0,0x1e,0x3,0xc3,0xa8,0xac,0x65,0xde,0xdd]);
Serial2.write(B.buffer);

Posted at 2022-01-16 by pelrun

Also, in case you missed it, Gordon has already integrated uploading the ble_epo_offline.bin file using the Assisted GPS app, and it makes a massive difference for TTFF even if a few messages are silently failing under the hood.

Posted at 2022-01-16 by Mark_M

So, that is great!, the issue with AGPS is resolved. ( Unless we want to dig deeper trying to load the "big" file from here https://api.smawatch.cn/epo/202201/. I've looked into the file, its data structure is not clear. )
@fanoush - your first item is covered.

Yes I saw Gordon has announced this app. I've just looked into the code. It pushes the file content to Serial. When I tried to do this similarly, manually loading the bin file to storage and then just read it into Uint8Array and pushed the buffer to Serial as a whole, the Serial chocked with FIFO error after couple of messages. CASIC doc tells not to push next message before ACK message is received. I've done it this way in my experimental code, that parses the content and pushes messages one by one. It works ok, though some messages fail with NACK. But at least it does not chock.
The only problem is - how to download the file. Gordon mentioned some Android Bangle Assistant/Companion app. May be this could help? Is there another way to get the file over BLE?

Posted at 2022-01-16 by pelrun

I feel like we're going around in circles here; not sure how many times I need to reiterate that the .DAT files you keep pointing to are not for the AT6558.

Posted at 2022-01-16 by Mark_M

https://api.smawatch.cn/epo/ble_epo_offline.bin is for AT6558
https://api.smawatch.cn/epo/202201/m2_epo_offline_2022-01-16_8187dedc4479046dfea07770bea2ecd1.DAT is not? Why do you think so? (Reiteration is not an explanation.)

Posted at 2022-01-16 by pelrun

You're the one who posted the information definitively identifying those files as being for Mediatek chipsets, so I don't know what else to tell you.

Posted at 2022-01-16 by Mark_M

Mediatek's one was from http://epodownload.mediatek.com/EPO.DAT
I've looked inside them again, structure-wise the both look similar. So yes, you are right. I was just confused. :)

Anyway what would be a best or easiest way for Bangle2 app to download the SMA .bin file from URL, without a need to go to Apps site and run Assisted GPS manually? This way it can be automated. Because the .bin file is updated at least daily there.

Posted at 2022-01-16 by HughB

So, that is great!, the issue with AGPS is resolved.

I'm not convinced. The code for the AGPS app is here:
https://github.com/hughbarney/BangleApps­/blob/master/apps/assistedgps/custom.htm­l

Lines 137-141 handle Bangle 1 and send UBLOX AGPS data.

Lines 142-155 handle Bangle 2 and only send a CAS04 NMEA command to select the type of GPS service. The code is incorrectly saying CASIC when these commands are NMEA protocol.
The CASIC checksum is a lot more complex than the code at 122-129 which is only doing a simple XOR checksum for NMEA commands.

The comments in lines 151-154, show that the author knows that to send AGPS to the Bangle 2 GPS chip you need to use the CASIC AID-INI (0x0B 0x01) message and this is not implemented yet.

UPDATE: I should add that using the AGPS app sending CAS04 set to GPS only I did observe the first fix time to be about 1 minute which is perfectly fine for what I want and I could just modify my GPS touch app to send a CAS04 first.

Posted at 2022-01-16 by Mark_M

CASIC AID-INI is probably for other data. In the .bin file there are 32 MSG-GPSEPH (0x08 0x07) messages, for each GPS satellite. Then one MSG-GPSION (0x08 0x06) and one MSG-GPSUTC (0x08 0x05). The last one I'd probably re-craft with more current time, if it will work.
All messages already have checksums pre-calculated. They are ready to be pushed to the chip.
The only my concern is, they need to be pushed one by one, after ACK for each message is received. That is how it is stated in the doc.

Posted at 2022-01-16 by HughB

The only my concern is, they need to be pushed one by one, after ACK for each message is received.

I assume you have sent these one by one manually. You probably only need a 30ms gap between each one. You can chain timeout or use promises. Or a really crude way.

send1() {
      Serial1()....
      setTimeout(  send2(), 25); 
}

send2() {
       Serial1()....
       setTimeout(  send3(), 25); 
}

On Bangle 1 - we just sent the data with enough delay and did not check for an ACK.
It would be possible to measure the time it takes to get the ACK back.

Posted at 2022-01-16 by Mark_M

I assume you have sent these one by one manually.

No, after one first message is pushed, when response is captured, I check if it is ACK class. If it is, I call pushing of second message, and so on, until the buffer's end is reached.

var EPO=new DataView(
  require("Storage").readArrayBuffer("ble_epo_offline.bin"));
var i=0, h1=0, h2=0, len=0, cs=0, p=0, pe=0,s="";
function pushNextAGPSMessage(){
  while(i<EPO.byteLength){
  h1=EPO.getUint8(i);
  h2=EPO.getUint8(i+1);
  if(h1==0xBA && h2==0xCE){
    s="";
    len=EPO.getUint16(i+2,true)+10;
    p=i; pe=p+len;
    print("push ",h1,h2, p, len);
    while(p<pe){
      s+=",0x"+EPO.buffer[p].toString(16);
      Serial2.write(EPO.buffer[p]);
      p++;
    }
    print(s);
    print(prsMsgGPSEph({payload:EPO.buffer},i+6));
    i=p;
    return;
  }else{i++;}
  }
}

D29.write(0);
Serial2.removeAllListeners();
Serial2.setup(9600,{rx:D30,tx:D31});
Serial2.removeAllListeners();
var msg;
Serial2.on('data', function(data){
//print(data);
  msg=parseCASIC(data);
  if(i<EPO.byteLength && typeof msg != 'undefined' && msg.class==0x05){ 
    msg=undefined;
    while(Serial2.available()>0)print('A');
    pushNextAGPSMessage();
  }
});

D29.write(1);

Serial2.println("$PCAS03,0,0,0,0,0,0,0,0,0,,0,,,0*32");

i=0;
pushNextAGPSMessage();

this code is very experimental. And parseCASIC(data) is not here. it is part of CASIC module I am working on.

Posted at 2022-01-18 by @gfwilliams

Thanks - sorry, if it seemed by response previously was a bit terse - it wasn't my intention :)

Anyway what would be a best or easiest way for Bangle2 app to download the SMA .bin file from URL, without a need to go to Apps site and run Assisted GPS manually?

Yeah, that is actually a whole other issue. The idea is eventually the Bangle.js-specific Gadgetbridge app for Android will run the App Loader website internally. It should then be able to run the AGPS upload code in the background (maybe at midnight?).

I'm not convinced. The code for the AGPS app is here:

@hughb I just don't understand. It is pretty clearly appending the data at https://github.com/hughbarney/BangleApps/blob/fa07467c4236409a00526254bce6c0ad35e5c623/apps/assistedgps/custom.html#L157-L160 and if you look with Puck.debug=3 in the console you'll see a big blob of data is being sent.

It seems users have reported it's working, so what exactly are you basing your assumption that it's not working/sending data on??

I did observe the first fix time to be about 1 minute which is perfectly fine for what I want and I could just modify my GPS touch app to send a CAS04 first.

We went through this exact thing with Bangle.js 1 didn't we? Why does your app need to send the command? If you use the AGPS app it should have configured your GPS just fine and hopefully there won't be a need to hard-code GPS config into the app.

For GPS config we could just port the GPS Setup app that existed for Bangle.js 1

@Mark_M it may be that streaming the data over bluetooth slows things down enough that everything works ok? I guess to check we'd need to move to Serial2 and the print the responses though.

Right now, we split the file into chunks of 128 bytes (https://github.com/hughbarney/BangleApps/blob/fa07467c4236409a00526254bce6c0ad35e5c623/apps/assistedgps/custom.html#L157-L160) - they're sent over serial and we actually wait for a response after the command has finished (that doesn't mean it's been sent over serial, but it does add a nice delay).

I guess it would make a lot of sense to detect the chunks of data in the ble_epo_offline.bin file and instead split the data into those blocks? That way we'd have a nice pause between transmission of each

Posted at 2022-01-18 by Mark_M

No problem :)

The idea is eventually the Bangle.js-specific Gadgetbridge app for Android will run the App Loader website internally. It should then be able to run the AGPS upload code in the background (maybe at midnight?).

Wow, that is complex. Is it possible, may be via the GB, or another way, just to download a content from an URL?

I guess it would make a lot of sense to detect the chunks of data in the ble_epo_offline.bin file and instead split the data into those blocks? That way we'd have a nice pause between transmission of each

I believe it would work better than just relying on 128 bytes chunks. Because end of previous message and beginning of next one can be inside a chunk.
And CASIC doc states in 2.5 CASIC message exchange, that app should not send next message before it receives ACK.
Though I do not trust Zhongke anymore :), and it can be Ok to send without awaiting for ACK, I just believe it makes sense to wait for it.

Regarding a pause. I am really missing it. Tried to implement sleep() in C, but got an error

Uncaught Error: 'E.InlineC' calls should have been replaced by the Espruino tools before upload

Posted at 2022-01-18 by @fanoush

Regarding a pause. I am really missing it.

there are promises, setTimeout (just google 'javascript sleep') or in this case you can send next message in ack/nack handler of previous message?

Tried to implement sleep() in C

To make fastest sleep ever? You can shoot yourself in the foot much easier in javascript via for or while loop, or even digitalPulse, no need for inline C to block everything.

Uncaught Error: 'E.InlineC' calls should have been replaced

this needs to run gcc behind scenes, you are probably copy pasting directly to console or directly upload file or compiler in WebIDE does not work for some reason.

Posted at 2022-01-18 by pelrun

The ephemerides are only valid for about 4 hours, so an upload at midnight is probably not too useful.

@Mark_M, the docs explicitly say CFG commands require waiting for an ACK, all others do not. The AGPS data only uses MSG commands. This is probably because the CFG commands modify flash settings, which are a lot slower than anything that just goes into RAM.

Posted at 2022-01-18 by @fanoush

so an upload at midnight is probably not too useful.

some agps documents describe the procedure how to find out that gps has stale data and needs it, attached translations.

the second one has chapter "when do you need AGNSS" with enabling status NMEA message for this and " If the time stamp is valid (non-zero) and the number of valid ephemeris is large (more than 8), there is no need to download the AGNSS"

Attachments:

• Long-term ephemeris (LTE) use document of Zhongke Microelectronics.pdf
• Zhongke Micro AGNSS Solution.pdf

Posted at 2022-01-18 by Mark_M

there are promises, setTimeout (just google 'javascript sleep')

promises are too cumbersome (for me :)). setTimeout is not blocking current "thread". Though it is possible to issue multiple growing timeouts for each message.

or in this case you can send next message in ack/nack handler of previous message?

That is exactly what I've done. And this is the best way. Better than a "pause".

To make fastest sleep ever? You can shoot yourself in the foot much easier in javascript via for or while loop, or even digitalPulse, no need for inline C to block everything.

while loop will eat energy. Sleep supposed to halt CPU. Yes in case of single threaded it will stop everything. Question - will it stop UARTs?

this needs to run gcc behind scenes, you are probably copy pasting directly to console

yes :(. Understood.

Posted at 2022-01-18 by Mark_M

the docs explicitly say CFG commands require waiting for an ACK, all others do not. The AGPS data only uses MSG commands. This is probably because the CFG commands modify flash settings, which are a lot slower than anything that just goes into RAM.

may be. I've just preferred to wait for ACK. One may use "a pause" or a natural slowness of BLE serial.

Posted at 2022-01-18 by Mark_M

fanoush. This doc is about LTE. They supposed to be loaded via AID class. The .bin data we load via MSG-GPS* is probably not LTE. Though MSG-GPSEPH is ephemerides. Short term ones? Needs to check what that $PCAS06,L*67\r\n shows before and after .bin loading.

Posted at 2022-01-19 by HughB

@hughb I just don't understand.

Ignore my previous statement on AGPS - I was plain wrong. I was looking for CASIC commands and checksumming. I did not realise that the download came pre-checksummed etc. The AGPS app clearly works and reduces the TTFF to 1 minute for me.

Posted at 2022-01-19 by HughB

For GPS config we could just port the GPS Setup app that existed for Bangle.js 1

That would be the plan if we can get the CASIC commands to work. But not a lot of success so far by the sound of things. I've not been actively looking at it recently.

Posted at 2022-01-19 by Mark_M

there is some success, depends which commands do you need.

Posted at 2022-01-19 by @gfwilliams

Is it possible, may be via the GB, or another way, just to download a content from an URL?

Not at the moment, but in the future it will be added. IMO using the App Loader is the less complex solution though as it means a lot less duplicated code, and less stuff running on the wath slowing it down :)

@fanoush finding out when AGPS data is needed would be really neat. It would be handy to be able to flag to the user when an update would help - I wasn't aware it only lasted 4 hours - that's not ideal :)

setTimeout is not blocking current "thread"

In Espruino, there is just one thread. So if you're writing inline C code that puts the device to sleep and waits for an interrupt, lots and lots of things are going to start breaking (including handling Serial data from the GPS, which I think you care about).

You can upload Inline C from the IDE (it's just not supported via the App Loader yet - you have to include the precompiled blob). Basically you just need to do what you're doing and wait for the JS data event. If you want to go deeper you'll have to compile your own Espruino firmware, and even then you have to work within the framework that is available - which means not blocking execution unless absolutely required.

Posted at 2022-01-20 by Mark_M

the App Loader is the less complex solution

May be App Loader is the less complex and more optimal, but it requires manual intervention.
There are not too much code to parse and push the .bin to GPS.
And it can be automated. App, after it turns on GPS checks if it needs AGPS. It can be done with using $PCAS06,L*6, or just checking if no fix in 1 minute. Or checking if a bin file is there, but it is too old. If it is, then app downloads new file and pushes it into GPS.

In Espruino, there is just one thread.

I know, I am probably too spoiled by multi-threaded environments. :)
I am completely convinced not to halt the CPU.
I am reading about Generators and Yeld/Next. It looks like a concept of "yeld" in Windows to allow main loop to process messages and then return control back to a function.

Posted at 2024-10-11 by @gfwilliams

Resuming this conversation on https://forum.espruino.com/conversations/400068/